5243af4c5264a1827f7cc4a3e6d9cd22dced772158e3c27b0b9a2047a3c1028b

Analysis

max time kernel
116s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2022 04:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5243af4c5264a1827f7cc4a3e6d9cd22dced772158e3c27b0b9a2047a3c1028b.exe
Size

122KB
MD5

64dc6ef2c592a1381db98abc28794540
SHA1

372a685f8d1ecf9cfd15ab60e093345ca9dbba4f
SHA256

5243af4c5264a1827f7cc4a3e6d9cd22dced772158e3c27b0b9a2047a3c1028b
SHA512

7675834f6624f75116661098a4a5d35e1fb9f669f74521095fd8a152bce0d66fb9f33c49197ca6fcec1cab484c41ecac1b30d9f339aef2b3abdfb7a7891c8047
SSDEEP

1536:wmAunwi6bNSiWrtpz0m3B+XoU+kOjxHWABdhmgSgxiiuISAY6oJK:wzunwoiezDR+Xp+kONbmgStN/yoo

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	5243af4c5264a1827f7cc4a3e6d9cd22dced772158e3c27b0b9a2047a3c1028b.exe
File opened (read-only)	\??\B:	5243af4c5264a1827f7cc4a3e6d9cd22dced772158e3c27b0b9a2047a3c1028b.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7z.exe	5243af4c5264a1827f7cc4a3e6d9cd22dced772158e3c27b0b9a2047a3c1028b.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	5243af4c5264a1827f7cc4a3e6d9cd22dced772158e3c27b0b9a2047a3c1028b.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4916	988	WerFault.exe	81

C:\Users\Admin\AppData\Local\Temp\5243af4c5264a1827f7cc4a3e6d9cd22dced772158e3c27b0b9a2047a3c1028b.exe
"C:\Users\Admin\AppData\Local\Temp\5243af4c5264a1827f7cc4a3e6d9cd22dced772158e3c27b0b9a2047a3c1028b.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
PID:988
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 988 -s 560
  2⤵
  - Program crash
  PID:4916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 988 -ip 988
1⤵
PID:4300

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/988-132-0x0000000001800000-0x0000000001826000-memory.dmp

Filesize
152KB

Download
memory/988-133-0x0000000001800000-0x0000000001826000-memory.dmp

Filesize
152KB

Download